What it does
Codex Security is a CLI (cs, short for codex-security) and a TypeScript SDK that scans code for security problems. You can aim it at a whole repository, selected paths or Git changes, and a deep mode runs parallel discovery workers. It then checks candidate findings, generates patches and verifies existing fixes. Around scanning, it can draft a SECURITY.md policy and save threat models, browse saved scans, flag duplicate findings, score severity with a rubric you supply, and propose owners based on the code and its Git history. Results can be exported as SARIF, JSON or CSV, imported from GitHub code scanning alerts, or published to Linear or a findings service. It can run in CI through a GitHub Action, and in containers for bulk scans across many repositories. Scans support OpenAI, Amazon Bedrock, OpenRouter and Fireworks AI as providers. Setup needs Node.js and Python 3.10 or newer, plus a sign-in with cs login or an API key. The repository is Apache-2.0 licensed.
Capabilities
- Scans whole repositories, chosen paths or Git diffs
- Validates candidate findings and generates patches
- Drafts SECURITY.md policies and saves threat models
- Exports SARIF, JSON or CSV and publishes to Linear
- GitHub Action and container support for CI and bulk scans
- Works with OpenAI, Bedrock, OpenRouter or Fireworks AI
When to use it
- You want to scan a repository or a pull request diff for vulnerabilities
- You need findings as SARIF or another format for CI or triage
- You maintain several repositories and want scans run as one campaign
